Medium severity · published Dec 18, 2024
CVE-2024-51470
IBM MQ denial of service
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD, IBM MQ Appliance 9.3 LTS, 9.3 CD, 9.4 LTS, and IBM MQ for HPE NonStop 8.1.0 through 8.1.0.25 could allow an authenticated user to cause a denial-of-service due to messages with improperly set values.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MQ
MQ · IBM
9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD · source: vendor
MA
MQ Appliance · IBM
9.3 LTS, 9.3 CD, 9.4 LTS · source: vendor, NVD
MF
MQ for HPE NonStop · IBM
8.1.0 through 8.1.0.25 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-51470
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-51470
Vendor Advisory
https://www.ibm.com/support/pages/node/7177593
Vendor Advisory
https://www.ibm.com/support/pages/node/7178085
Vendor Advisory
https://www.ibm.com/support/pages/node/7179137
More from MQ
9.8
CVE-2026-10027
IBM MQ queue manager is vulnerable to unauthenticated remote code execution
9.8
CVE-2026-12351
IBM MQ is vulnerable to unauthenticated remote code execution via JNDI injection
9.8
CVE-2020-4682
IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data
9.1
CVE-2022-22489
IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data
8.8
CVE-2026-11725
IBM MQ queue manager is vulnerable to privilege escalation